Analysis
-
max time kernel
144s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:16
Static task
static1
Behavioral task
behavioral1
Sample
e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe
Resource
win7-20230831-en
General
-
Target
e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe
-
Size
1.1MB
-
MD5
59de5c5c23cf28cbad2b8334d7acd22f
-
SHA1
e4db55823db417277ef44a556ebe70ab7d99a0f2
-
SHA256
e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9
-
SHA512
713cc0333a8a3f3b8242051bb4fe2e422853a76079ed7971d9568a8c8b492ecf8bb096419ede10b165563c9ea355490a3a123cb78249052bee7537060cbfc546
-
SSDEEP
24576:1yenZiZpalNopH2tDAJxdTHYN0SDDbchBp:QeZiZpalukGDlSL
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1168-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1168-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1168-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1168-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4920-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet5006290.exeu8571543.exeexplonde.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t5006290.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u8571543.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explonde.exe -
Executes dropped EXE 16 IoCs
Processes:
z1391409.exez4919348.exez4227290.exez5498687.exeq6498124.exer7700694.exes9191524.exet5006290.exeexplonde.exeu8571543.exelegota.exew9947011.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 1632 z1391409.exe 984 z4919348.exe 4876 z4227290.exe 4852 z5498687.exe 432 q6498124.exe 1392 r7700694.exe 3752 s9191524.exe 948 t5006290.exe 5020 explonde.exe 4660 u8571543.exe 4448 legota.exe 2428 w9947011.exe 4800 explonde.exe 4844 legota.exe 1312 explonde.exe 3488 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3900 rundll32.exe 4936 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4227290.exez5498687.exee56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exez1391409.exez4919348.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4227290.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z5498687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1391409.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4919348.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q6498124.exer7700694.exes9191524.exedescription pid process target process PID 432 set thread context of 4920 432 q6498124.exe AppLaunch.exe PID 1392 set thread context of 1168 1392 r7700694.exe AppLaunch.exe PID 3752 set thread context of 2340 3752 s9191524.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3348 432 WerFault.exe q6498124.exe 1232 1392 WerFault.exe r7700694.exe 1116 1168 WerFault.exe AppLaunch.exe 4052 3752 WerFault.exe s9191524.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2224 schtasks.exe 2060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4920 AppLaunch.exe 4920 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4920 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exez1391409.exez4919348.exez4227290.exez5498687.exeq6498124.exer7700694.exes9191524.exet5006290.exeu8571543.exeexplonde.exedescription pid process target process PID 2676 wrote to memory of 1632 2676 e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe z1391409.exe PID 2676 wrote to memory of 1632 2676 e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe z1391409.exe PID 2676 wrote to memory of 1632 2676 e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe z1391409.exe PID 1632 wrote to memory of 984 1632 z1391409.exe z4919348.exe PID 1632 wrote to memory of 984 1632 z1391409.exe z4919348.exe PID 1632 wrote to memory of 984 1632 z1391409.exe z4919348.exe PID 984 wrote to memory of 4876 984 z4919348.exe z4227290.exe PID 984 wrote to memory of 4876 984 z4919348.exe z4227290.exe PID 984 wrote to memory of 4876 984 z4919348.exe z4227290.exe PID 4876 wrote to memory of 4852 4876 z4227290.exe z5498687.exe PID 4876 wrote to memory of 4852 4876 z4227290.exe z5498687.exe PID 4876 wrote to memory of 4852 4876 z4227290.exe z5498687.exe PID 4852 wrote to memory of 432 4852 z5498687.exe q6498124.exe PID 4852 wrote to memory of 432 4852 z5498687.exe q6498124.exe PID 4852 wrote to memory of 432 4852 z5498687.exe q6498124.exe PID 432 wrote to memory of 2008 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 2008 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 2008 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 432 wrote to memory of 4920 432 q6498124.exe AppLaunch.exe PID 4852 wrote to memory of 1392 4852 z5498687.exe r7700694.exe PID 4852 wrote to memory of 1392 4852 z5498687.exe r7700694.exe PID 4852 wrote to memory of 1392 4852 z5498687.exe r7700694.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 1392 wrote to memory of 1168 1392 r7700694.exe AppLaunch.exe PID 4876 wrote to memory of 3752 4876 z4227290.exe s9191524.exe PID 4876 wrote to memory of 3752 4876 z4227290.exe s9191524.exe PID 4876 wrote to memory of 3752 4876 z4227290.exe s9191524.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 3752 wrote to memory of 2340 3752 s9191524.exe AppLaunch.exe PID 984 wrote to memory of 948 984 z4919348.exe t5006290.exe PID 984 wrote to memory of 948 984 z4919348.exe t5006290.exe PID 984 wrote to memory of 948 984 z4919348.exe t5006290.exe PID 948 wrote to memory of 5020 948 t5006290.exe explonde.exe PID 948 wrote to memory of 5020 948 t5006290.exe explonde.exe PID 948 wrote to memory of 5020 948 t5006290.exe explonde.exe PID 1632 wrote to memory of 4660 1632 z1391409.exe u8571543.exe PID 1632 wrote to memory of 4660 1632 z1391409.exe u8571543.exe PID 1632 wrote to memory of 4660 1632 z1391409.exe u8571543.exe PID 4660 wrote to memory of 4448 4660 u8571543.exe legota.exe PID 4660 wrote to memory of 4448 4660 u8571543.exe legota.exe PID 4660 wrote to memory of 4448 4660 u8571543.exe legota.exe PID 5020 wrote to memory of 2224 5020 explonde.exe schtasks.exe PID 5020 wrote to memory of 2224 5020 explonde.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe"C:\Users\Admin\AppData\Local\Temp\e56c450d7d2254acf7ae9bd9e3cfc00a6b259c6d1a8f2acac9f50c10720b54f9_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1391409.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1391409.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4919348.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4919348.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4227290.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4227290.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5498687.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5498687.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6498124.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6498124.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 5807⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7700694.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7700694.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 5687⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9191524.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9191524.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 5646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5006290.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5006290.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8571543.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8571543.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9947011.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9947011.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 432 -ip 4321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1392 -ip 13921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1168 -ip 11681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3752 -ip 37521⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9947011.exeFilesize
22KB
MD5c81c7446a329da7194a4a7c7996377cb
SHA187d0b54819e7abe237f997a063eb324ae610e7f3
SHA256b6b4587efb6bd58db50d29e7ce47b14c69e7b78544e706b627bfe8fd7f391865
SHA512d943b9f49d52a831886728747b61f24c267d60e7e75acad1e1efc8012df3953a0c36fce0073ff2065bc75a3fc73f6f5f1dcc95432753c4eddfde664234fb169c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9947011.exeFilesize
22KB
MD5c81c7446a329da7194a4a7c7996377cb
SHA187d0b54819e7abe237f997a063eb324ae610e7f3
SHA256b6b4587efb6bd58db50d29e7ce47b14c69e7b78544e706b627bfe8fd7f391865
SHA512d943b9f49d52a831886728747b61f24c267d60e7e75acad1e1efc8012df3953a0c36fce0073ff2065bc75a3fc73f6f5f1dcc95432753c4eddfde664234fb169c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1391409.exeFilesize
994KB
MD5bdd17660d08cfd8aae4ff7c4faa8ec30
SHA12dac85599fa8416a357a5a568248f855f1948f37
SHA256420c5dfb06e9bc344505e3462e4302dab2d81fb08c1b27150de833c4d9fcad6e
SHA5124481f11f0129b1ea7c33a2da9069eafb4a9c2b479a1c523d975c8512b5c205033d9b16c46a526a2155c5dfd1c2c888c5e8b47c62f7232b1fc9a55dd4235860f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1391409.exeFilesize
994KB
MD5bdd17660d08cfd8aae4ff7c4faa8ec30
SHA12dac85599fa8416a357a5a568248f855f1948f37
SHA256420c5dfb06e9bc344505e3462e4302dab2d81fb08c1b27150de833c4d9fcad6e
SHA5124481f11f0129b1ea7c33a2da9069eafb4a9c2b479a1c523d975c8512b5c205033d9b16c46a526a2155c5dfd1c2c888c5e8b47c62f7232b1fc9a55dd4235860f2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8571543.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8571543.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4919348.exeFilesize
815KB
MD57cd130afbd753e5b328b09f844f1028a
SHA1e59b817d8b9affb580f040f538f3287a7d651716
SHA2568cf4affa797ee44204b617315bff99e9fd897424ee6d1eb6ddb374913340098e
SHA5123e13f79fa3bcbfd10e272463f77697f8c0d2b37d7fcefadaa8ca664831e023f4a81d6db90a4df9745d9de3be9ab16c2490542a642facd5b3eceb7c00c0d99842
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4919348.exeFilesize
815KB
MD57cd130afbd753e5b328b09f844f1028a
SHA1e59b817d8b9affb580f040f538f3287a7d651716
SHA2568cf4affa797ee44204b617315bff99e9fd897424ee6d1eb6ddb374913340098e
SHA5123e13f79fa3bcbfd10e272463f77697f8c0d2b37d7fcefadaa8ca664831e023f4a81d6db90a4df9745d9de3be9ab16c2490542a642facd5b3eceb7c00c0d99842
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5006290.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5006290.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4227290.exeFilesize
632KB
MD5dc7106f49da4153d7d654a22182f5d49
SHA1afaf7045c54b8b5b36526b41c0e8b3aab8747a01
SHA2561fee10de204bc2ac5029b18f8c7fc6bef34b6a0c437142d8dcb5debb88ead9e9
SHA5128f38e6ea06bedd81ae66268bc5482f8014bf0ad8d4ee399e38dde0a73586f56df74ba36c5a4ef752ce188acf9c4ab80711afec0f16fb557baade14f5fbd95e84
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4227290.exeFilesize
632KB
MD5dc7106f49da4153d7d654a22182f5d49
SHA1afaf7045c54b8b5b36526b41c0e8b3aab8747a01
SHA2561fee10de204bc2ac5029b18f8c7fc6bef34b6a0c437142d8dcb5debb88ead9e9
SHA5128f38e6ea06bedd81ae66268bc5482f8014bf0ad8d4ee399e38dde0a73586f56df74ba36c5a4ef752ce188acf9c4ab80711afec0f16fb557baade14f5fbd95e84
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9191524.exeFilesize
413KB
MD5f420a63960771d8524c15e113eabcff6
SHA15c9825e54fce99d8b01d801e8f9566357bef27eb
SHA2568c0e94641260a29133c6fb57aea116a78edaa22756e64ead25c12ef86421701d
SHA512c274ab2f11890f9f75702d359994edaaa16a1e0c5cb2ae729fe7bceed91d3e7a36999a04fcc33fac8c94b150b959584612106f4b2650ecb4ec63926baa60fb58
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9191524.exeFilesize
413KB
MD5f420a63960771d8524c15e113eabcff6
SHA15c9825e54fce99d8b01d801e8f9566357bef27eb
SHA2568c0e94641260a29133c6fb57aea116a78edaa22756e64ead25c12ef86421701d
SHA512c274ab2f11890f9f75702d359994edaaa16a1e0c5cb2ae729fe7bceed91d3e7a36999a04fcc33fac8c94b150b959584612106f4b2650ecb4ec63926baa60fb58
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5498687.exeFilesize
353KB
MD55557637cbbad9a21e5c07f7ea9c8bf86
SHA17587ee6498d5fe6494a89fe15a686c284d47ac38
SHA2568afa6cfc56b751b0bec7853359b63b660f8facfcfc786c1008c1cb714837029a
SHA512ab74fea6073255f092eb8fc7905a6860f497d64c2d7abd0df59e907b4a6f928fc1f3f6548eb34fff8a7317e2d61af84a587728269c19993d8656f867487dc1d6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5498687.exeFilesize
353KB
MD55557637cbbad9a21e5c07f7ea9c8bf86
SHA17587ee6498d5fe6494a89fe15a686c284d47ac38
SHA2568afa6cfc56b751b0bec7853359b63b660f8facfcfc786c1008c1cb714837029a
SHA512ab74fea6073255f092eb8fc7905a6860f497d64c2d7abd0df59e907b4a6f928fc1f3f6548eb34fff8a7317e2d61af84a587728269c19993d8656f867487dc1d6
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6498124.exeFilesize
250KB
MD5edff6b213aa8a614b055f1028b15d6ad
SHA1bbba7aa983dc120e4636ef59006504b44c208921
SHA2564365c03ddaeeff762388dc545eb52b5d78c4877fe411762b35cde458f8df0253
SHA512363398434f693c9b70b217b3f5b183bc6134dc86627135e3fdf818c68bfb8c1e53c5675dcfa7819e1ba474d9d3cf265ed50a1a9d0766aa67402fb500440a70f3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6498124.exeFilesize
250KB
MD5edff6b213aa8a614b055f1028b15d6ad
SHA1bbba7aa983dc120e4636ef59006504b44c208921
SHA2564365c03ddaeeff762388dc545eb52b5d78c4877fe411762b35cde458f8df0253
SHA512363398434f693c9b70b217b3f5b183bc6134dc86627135e3fdf818c68bfb8c1e53c5675dcfa7819e1ba474d9d3cf265ed50a1a9d0766aa67402fb500440a70f3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7700694.exeFilesize
379KB
MD579c65f2315d52c6bc3690aa0e280570b
SHA1f4a9cf1d23c24cf93787c9443ef6f00e6579c964
SHA256a888d96e678a36024bf9f703b51f6504d8eae61ad5411bfc546b45c49509883d
SHA512a39693c238056dd5802037987e2ef069d0bde2280e894345ac3c0154e5a912dface33e8842edea44155d9b1c70cf41f40e3002efcb8ceb8a7b75fc7f19597da1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7700694.exeFilesize
379KB
MD579c65f2315d52c6bc3690aa0e280570b
SHA1f4a9cf1d23c24cf93787c9443ef6f00e6579c964
SHA256a888d96e678a36024bf9f703b51f6504d8eae61ad5411bfc546b45c49509883d
SHA512a39693c238056dd5802037987e2ef069d0bde2280e894345ac3c0154e5a912dface33e8842edea44155d9b1c70cf41f40e3002efcb8ceb8a7b75fc7f19597da1
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1168-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1168-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1168-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1168-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2340-52-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/2340-50-0x00000000016F0000-0x00000000016F6000-memory.dmpFilesize
24KB
-
memory/2340-88-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB
-
memory/2340-57-0x000000000AD10000-0x000000000AE1A000-memory.dmpFilesize
1.0MB
-
memory/2340-53-0x000000000B220000-0x000000000B838000-memory.dmpFilesize
6.1MB
-
memory/2340-66-0x000000000ACB0000-0x000000000ACFC000-memory.dmpFilesize
304KB
-
memory/2340-64-0x000000000AC60000-0x000000000AC9C000-memory.dmpFilesize
240KB
-
memory/2340-59-0x000000000AC00000-0x000000000AC12000-memory.dmpFilesize
72KB
-
memory/2340-49-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/2340-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2340-58-0x0000000005770000-0x0000000005780000-memory.dmpFilesize
64KB
-
memory/4920-63-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/4920-51-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/4920-36-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/4920-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB